Kevin Branch - 2009-03-25

I am trying to make an external script dynamically generate an http link to my BASE application that is preloaded with everything necessary to query for all events with a source or destination of a specific IP of interest.  I manually set up a query in BASE like I want the script to generate, with 10.20.30.40 as the IP to query for as an example.   Then I sniffed out the HTTP GET request that was transmitted when I clicked the "Query DB" button.  The result was a link like this.

http://myserver.mydomain.org/base/base_qry_main.php?search=1&sensor=+&ag=+&sig\[0]=+&sig[2]=%3D&sig[1]=&sig_class=+&sig_priority[0]=+&sig_priority[1]=&time[0][0]=+&time[0][1]=+&time[0][2]=+&time[0][3]=&time[0][4]=+&time[0][5]=&time[0][6]=&time[0][7]=&time[0][8]=+&time[0][9]=+&ip_addr[0][0]=+&ip_addr[0][1]=ip_both&ip_addr[0][2]=%3D&ip_addr[0][3]=10.20.30.40&ip_addr[0][8]=+&ip_addr[0][9]=+&ip_field[0][0]=+&ip_field[0][1]=+&ip_field[0][2]=%3D&ip_field[0][3]=&ip_field[0][4]=+&ip_field[0][5]=+&data_encode[0]=+&data_encode[1]=+&data[0][0]=+&data[0][1]=+&data[0][2]=&data[0][3]=+&data[0][4]=+&new=1&sort_order=none&submit=Query+DB&caller=&num_result_rows=-1&current_view=-1

My goal is to be able to email such a link to a user who will click on the link as their first point of entry into the BASE app.  It almost works, too.

If I open a new web browser instance and try to surf to this link cold, it gives me back search results that appear to represent ALL records in BASE, somehow ignoring my IP criteria.  However, if I first manually surf to BASE and click on the Search link without filling anything in, I can then click on my preconfigured link and it gives me the correct search results.

Am I missing something?  Is there some magic tweak I can apply to my preconfigured BASE Search link or is there a completely better way I might approach this?

I love BASE and use it frequently for initial assessment of alerts that other scripts identify as potentially interesting.  However, having to manually set up a BASE Search query rather slows down a process that needs to be repeated often.  Thanks in advance for any insight you all can offer.

Kevin